CVE-2026-64576: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64576 is an uninitialized pointer dereference vulnerability in the Linux kernel's nexthop module that can cause a kernel panic (denial of service). The flaw exists in nh_res_bucket_migrate(), which passes an uninitialized netlink_ext_ack structure to call_nexthop_res_bucket_notifiers(); when a memory allocation failure occurs, the error path dereferences the stale pointer, triggering a general protection fault. The vulnerability affects Linux kernel versions from 5.13 up to (but not including) the fixed stable releases, and was published on August 5, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-824 (Access of Uninitialized Pointer). In nh_res_bucket_migrate() (net/ipv4/nexthop.c), a netlink_ext_ack variable is declared on the stack but never zero-initialized before being passed to call_nexthop_res_bucket_notifiers(). If nh_notifier_res_bucket_info_init() fails — for example, due to a kzalloc returning -ENOMEM — the error path calls pr_err_ratelimited("%s\n", extack._msg) with a stale, uninitialized pointer, resulting in a wild memory access and kernel panic. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user with access to netlink nexthop configuration commands. When CONFIG_INIT_STACK_NONE is set, the stack is not automatically zeroed, making the bug reliably triggerable (GitHub Advisory).

Successful exploitation causes a kernel panic (Kernel panic - not syncing: Fatal exception), resulting in a complete system crash and denial of service. The confidentiality impact is rated High because the uninitialized stack memory read could expose sensitive kernel memory contents before the crash. Integrity is not directly affected, but availability is fully compromised for the duration of the crash and any required reboot (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.156%, indicating a low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface primarily to multi-tenant or shared Linux environments.

1. Gain local access: Obtain a low-privileged local account on a vulnerable Linux system (kernel 5.13 through the unpatched stable versions) with CONFIG_INIT_STACK_NONE enabled.
2. Trigger nexthop configuration: Use a netlink socket to issue a nexthop configuration request (e.g., via ip nexthop commands or raw RTM_NEWNEXTHOP netlink messages) that causes the kernel to enter nh_res_bucket_migrate().
3. Induce memory allocation failure: Craft conditions (e.g., via memory pressure or resource exhaustion) so that nh_notifier_res_bucket_info_init() fails with -ENOMEM, causing kzalloc to return NULL.
4. Trigger uninitialized pointer dereference: The error path in nh_res_bucket_migrate() calls pr_err_ratelimited("%s\n", extack._msg) with the uninitialized extack._msg pointer, dereferencing arbitrary stack memory.
5. Achieve kernel panic: The dereference of a non-canonical address triggers a general protection fault, resulting in a kernel panic and system crash (GitHub Advisory).

• Logs: Kernel log entries containing Oops: general protection fault, probably for non-canonical address or KASAN: maybe wild-memory-access in range near stack traces referencing nh_res_bucket_migrate, nh_res_table_upkeep, rtm_new_nexthop, or rtnetlink_rcv_msg.
• Logs: Kernel panic - not syncing: Fatal exception messages in /var/log/kern.log or dmesg output.
• Process: Unusual or repeated ip nexthop commands or raw netlink socket activity from low-privileged user accounts.
• System: Unexpected system reboots or crash dumps (e.g., kdump files) on systems handling nexthop routing configuration.

Apply the upstream kernel patches that zero-initialize the extack structure in nh_res_bucket_migrate(). Fixed versions include: 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2 (and later). Microsoft has also released a patch for the affected Azure Linux 3 kernel package (azl3_kernel_6.6.145.2-1). As a workaround, restrict access to netlink nexthop configuration commands to trusted/privileged users only, and monitor for kernel panics related to nexthop operations (GitHub Advisory, Red Hat, Microsoft MSRC).

Red Hat has acknowledged the vulnerability and assigned it a Moderate severity rating, with a Bugzilla entry tracking the fix (Red Hat Bugzilla). Microsoft has issued a security advisory for the affected Azure Linux kernel package (Microsoft MSRC). The Yocto Project security mailing list and AUSCERT have also issued notifications to their respective communities. No significant social media discussion or notable researcher commentary has been observed beyond standard vulnerability tracking.